Privacy policy
What we collect
- Account: name, email, country, a hashed password.
- Bookings and messages: what you type into the booking, contact and start forms (for a booked call: name, email, company, notes, the time you chose and your time zone). Call bookings are stored in our own database; no third-party calendar or booking service is used. We email you a confirmation with a calendar file and a link to cancel.
- Orders: package, amounts, payment status and reference. Card details are handled by Stripe and never reach us.
- Projects: intake answers, files you upload, approvals, tickets, and the public title and description of your site if you ask us to fetch them.
- Site checks: results of health and performance checks on your website.
- Technical: server logs needed to run and secure the service.
- Campaign tags: if you arrive from a link tagged with utm_source, utm_medium or utm_campaign, those tags are stored with an order you place, to see which campaigns work.
- Emails: if you tick “email me this report” on the site check, your email and the time you agreed. Every such email has an unsubscribe link.
The website assistant
The “Ask bytyn” assistant is automated. What you type is used to answer you and is not stored, unless you press “Send to bytyn”, which saves your name, email and a summary as an enquiry. If an AI model is enabled, your messages are sent to it to write the answer; prices are always calculated by our own price list. Do not type passwords or payment details into it.
Location and currency
To show prices in your currency and preset your country, we look up the country of your IP address. The lookup runs locally on our own server; your IP address is not sent to anyone else. The country is stored with an order as VAT evidence, and you can always change the currency and country yourself.
Why
To provide the service you asked for, to bill it, to keep it secure, and to meet legal obligations. We do not sell data. We measure whether our Google ads lead to purchases or enquiries only if you allow marketing cookies; we do not build advertising profiles.
Who else processes it
- Stripe, for card payments, if you pay by card.
- Our email provider, to send account and project emails.
- Our hosting provider, which runs the servers.
- Umami, a self-hosted, open-source and cookie-free analytics tool on our own server: page views and buying steps, without IP addresses or cookies. See cookies.
- PostHog (EU servers, through bytyn.com/ingest) stores your IP address with the approximate location (country and city) derived from it, and records how pages are used (clicks, scrolling, mouse movement, the page as you see it, load and network timings), for every visitor whatever you choose in the cookie banner. Everything you type and all text in forms is hidden in your browser; card fields, the portal, admin and checkout are never recorded. Visit data (including IP address and location) and recordings are kept for 30 days, then deleted. We do this to find and fix confusing pages, tell real visits from bots and see roughly where visits come from, on legitimate interest (Art. 6(1)(f) GDPR); without analytics cookies it uses no cookies or browser storage. You can object at any time by writing to hello@bytyn.com; see cookies.
- Google Analytics 4 (Google Ireland Limited / Google LLC), only if you allow analytics cookies.
- Google Ads conversion tracking (Google Ireland Limited / Google LLC), only if you allow marketing cookies.
Google Analytics and Google Ads
These run only with your consent (UK GDPR and EU GDPR Art. 6(1)(a), and the cookie rules in PECR and the ePrivacy Directive). Until you agree, no Google code is loaded. We send page views, buying steps, and for a purchase the order reference, package, amount and currency; never your name, email or other contact details.
- Google Analytics 4: Google acts as our processor under its data processing terms. IP addresses are not stored, Google signals and data sharing for Google’s own products are off. Data is kept for 14 months.
- Google Ads: for conversion measurement Google acts as our processor; Google may also use ad click data as an independent controller under its controller-to-controller terms (see Google’s business data responsibility page).
- Transfers: Google may process data in the United States. Google LLC is certified under the EU–US Data Privacy Framework and its UK Extension, so transfers rely on the adequacy decisions for those; Google’s Standard Contractual Clauses apply otherwise.
- Withdraw at any time: , then “Reject all”. We stop loading Google’s code and delete its cookies on bytyn.com. Withdrawing does not affect what was processed before.
How long
Account and project data for as long as you have an account, then up to 90 days. Invoices and order records for as long as accounting law requires. Booking and contact messages that do not lead to a project, up to 12 months.
Your rights
You can ask to see, correct, export or delete your data, and you can object to processing. Write to hello@bytyn.com. We reply within 30 days. You may also complain to your local data protection authority.
Security
See security.